Posts posted by Nathan Explosion
-
-
-
-
-
-
-
-
Edited by Nathan Explosion
Here are your reproduction steps...
- Login to a site
- Logout
- Change your IP address
- Login to the site again, ensuring same browser and account
- Set the "Remove IP addresses after" setting to whatever you want (I believe the minimum is 1 day)
- Wait that amount of time, then run the task.
To reproduce it quicker, you're going to need to manipulate database records to change the last_seen value to meet the criteria.
Potential fix: modify that primary key to include the last_seen value.
-
-
Posted ·
Edited by Nathan Explosion
Reporting it as it just occurred on my live site...
UPDATE `core_members_known_ip_addresses` `core_members_known_ip_addresses` SET `ip_address`='' WHERE ip_address != '' AND last_seen <1709136738 IPS\Db\Exception: Duplicate entry '0138fdaa72c8135e62b3487f5be7b11d-2970-' for key 'PRIMARY' (1062) #0 /home/fbaeefdf/live.ynwa.tv/system/Db/Db.php(1159): IPS\_Db->preparedQuery() #1 /home/fbaeefdf/live.ynwa.tv/applications/core/extensions/core/IpAddresses/Logins.php(33): IPS\_Db->update() #2 /home/fbaeefdf/live.ynwa.tv/system/Member/Member.php(6504): IPS\core\extensions\core\IpAddresses\_Logins->pruneIpAddresses() #3 /home/fbaeefdf/live.ynwa.tv/applications/core/tasks/pruneipaddresses.php(43): IPS\_Member::pruneAllLoggedIpAddresses() #4 /home/fbaeefdf/live.ynwa.tv/system/Task/Task.php(281): IPS\core\tasks\_pruneipaddresses->execute() #5 /home/fbaeefdf/live.ynwa.tv/applications/core/modules/admin/settings/advanced.php(751): IPS\_Task->run() #6 /home/fbaeefdf/live.ynwa.tv/system/Dispatcher/Controller.php(107): IPS\core\modules\admin\settings\_advanced->runTask() #7 /home/fbaeefdf/live.ynwa.tv/applications/core/modules/admin/settings/advanced.php(38): IPS\Dispatcher\_Controller->execute() #8 /home/fbaeefdf/live.ynwa.tv/system/Dispatcher/Dispatcher.php(153): IPS\core\modules\admin\settings\_advanced->execute() #9 /home/fbaeefdf/live.ynwa.tv/admin/index.php(13): IPS\_Dispatcher->run() #10 {main}
I believe this is a knock-on effect of it NOT having been pruning the IP addresses correctly previously - the issue you'll have is that there could be multiple entries for a specific device_key and member_id, but with different IP addresses. Now that task has been fixed to do the pruning, when it tries to remove the IP address on those multiple entries, the PRIMARY key for each row will end up being the same as the key is made up of device_key, member_id, IP address (which is now blank)
Sample content attached:core_members_known_ip_addresses.sql
When the query in the task runs against that data, the error occurs:
UPDATE `core_members_known_ip_addresses` `core_members_known_ip_addresses` SET `ip_address`='' WHERE ip_address != '' AND last_seen <1709135288
-
-
-
If you are using Windows Defender then report it as a false positive back to Microsoft:
-
Edited by Nathan Explosion
I'll be disabling that functionality until this is resolved then...just been alerted to a data leak (title of a private topic being visible) which is going to cause a few problems now that it's been seen.
Test of a topic in a private forum, viewable by a normal member...
-
-
-
-
-
2 minutes ago, LiamH said:
but somehow we are recently getting exactly that.
It's designed to allow them...they can "Post before registering" as your members group has permissions to do so...
If someone in your members group can post in a location where guests cannot, then guests will be able to post.
-
-
@LiamH - just checked your site as a guest; there are several forums open to allow guests to post new topics.
I suggest you look at the permissions that the Guest group has for forums:
You also have "Post before registering" enabled:
-
-
-
-
4.7.16 update doesn't work
in Classic self-hosted technical help
Seeing as there were some other people who reported this and were actually running an unsupported version of PHP...what version of PHP do you currently have in use? (view it on the Support page in the ACP)
If it is NOT 8.0 or 8.1, and is 8.2 or 8.3 then drop down to a support version (8.0 & 8.1)